Who it’s for
You run a hospital, a practice or a medical care centre. Patient data, connected medical equipment and the telematics infrastructure make IT security mandatory, and an outage directly affects patient care. Complass sorts your obligations by type of facility and helps you implement and evidence them.
Ransomware or a failure of the telematics infrastructure paralyses admission, documentation and diagnostics. Emergency operation and recovery have to be prepared.
Devices with old operating systems, remote maintenance by vendors and telematics infrastructure connectors: a complete inventory is often missing.
SGB V, NIS2, critical infrastructure rules and the GDPR interlock, and practices and many hospitals have no security team of their own.
Which requirements apply depends on the type and size of the facility:
Frameworks: IT security guideline · B3S hospitals · NIS2 · GDPR · ISO 27001 · KRITIS Umbrella Act
Not sure which frameworks apply to you? Start the applicability check
Costs, effort and time: consultant only, consultant with Complass or in-house with Complass? Open the compliance cost calculator
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
Precautions under Section 391 SGB V with the B3S as the yardstick, above the threshold critical infrastructure with evidence to the BSI.
The IT security guideline by practice size, without a security team of your own and with little effort.
Several sites, shared IT: from medium size onwards NIS2 is added to the IT security guideline.
Medical equipment, practice and clinical IT, connectors and building services in one inventory, with end of support and known vulnerabilities.
More about this featureRecord incidents and check whether a report to the BSI or to the data protection authority is required, with the deadlines in view.
More about this featureBusiness impact analysis and contingency plans for the failure of clinical IT, the telematics infrastructure or service providers.
Classify practice IT service providers and maintenance companies and request evidence directly from them.
More about this feature
Three ways in for healthcare: the industry template for practices and medical care centres with the IT security guideline, the industry template for hospitals with the B3S, and the Practice package with fixed content for small practices. The templates preselect frameworks and building blocks and have no price of their own; you book them with the package of your choice and adjust the selection in the configurator.
available
from €456 per month plus VAT in the Start package, size S, annual payment
available
from €456 per month plus VAT in the Start package, size S, annual payment
available
from €79 per month plus VAT annual payment
All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 16 October 2026. Enterprise and groups of companies on request.
Usually not: NIS2 applies only from medium size onwards. The IT security guideline under Section 390 SGB V, however, applies to all practices in statutory health care, with fewer requirements for small practices.
This page is aimed at facilities that operate medical equipment. The medical technology page is aimed at manufacturers who develop medical devices and place them on the market under the MDR or IVDR.
Yes. The IT security guideline under Section 390 SGB V, the B3S for hospitals, NIS2, GDPR, ISO 27001 and asset, incident and business continuity management are available.
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
